Release 2.8.0 Fri April 24 2026
Security fixes:
#47 #1183 CVE-2026-41080 -- The existing hash flooding protection
(based on SipHash) only used 4 to 8 bytes of entropy for
a salt, when 16 bytes of salt are supported by the
implementation of SipHash used by Expat. Now full 16 bytes
of entropy are used to improve protection against hash
flooding attacks.
Existing API function XML_SetHashSalt is now deprecated
because of its limitations, and its use should be
considered a vulnerability. Please either use the new API
function XML_SetHashSalt16Bytes (with known-high-quality
entropy input only!) instead, or leave the derivation of
a 16-bytes hash salt from high quality entropy to Expat's
internal machinery (by *not* calling either of the two
XML_SetHashSalt* functions).
Bug fixes:
#1188 Avoid propagating /dev/urandom file descriptor to child
[46 lines not shown]
textproc/docbook-xsl-ns: initial import
The DocBook XSL stylesheets provide a serie of ready-to-use templates to
process documents based on the DocBook XML DTD. They can generate different
types of output files, like XHTML, slides, manpages, JavaDoc...
These are namespace-aware XSLT stylesheets for the DocBook DTD and its
derivatives (Simplified DocBook, etc.).
Support non-static mappings, allocating space from kernel_map.
Still TODO: platform-specific hook for a vmem arena that supplies
the VAs for a given bus.
Add bus_space_mmap() to the simple implmentation, and provide a default
implementation that returns failure; if a platform wants to support this,
it will need to provide a _bus_space_mmap() implementation that matches
the address ranges that are to be supported for this operation.
graphics/colord: update to 1.4.8
# pkgsrc changes
* Switch to meson.
* Enable gusb and gudev support, among others.
* Install bash completions and man pages.
* Move some stuff to options.mk to make it optional.
* Patch to allow build on systems without libudev support.
* Use SUBST instead of patching to replace hard-coded paths.
# upstream changes (since 1.3.5)
Version 1.4.8
~~~~~~~~~~~~~
Released: 2025-06-23
New Features:
- Add AppStream metainfo XML with hardware provide info (Petter Reinholdtsen)
- Add support for -Dsystemd_root_prefix to make local building easier (Richard Hughes)
[138 lines not shown]
Update to 2026b, previous was 2026a
Release 2026b - 2026-04-22 23:06:43 -0700
Changes to code
zic no longer mishandles a last transition to a new time type.
zic no longer overflows a buffer when generating a TZ string like
"PST-167:59:58PDT-167:59:59,M11.5.6/-167:59:59,M12.5.6/-167:59:59",
which can occur with adversarial input. (Thanks to Naveed Khan.)
zic no longer generates a longer TZif file than necessary when
an earlier time zone abbreviation is a suffix of a later one.
As a nice side effect, zic no longer overflows a buffer when given
a long series of abbreviations, each a suffix of the next.
(Buffer overflow reported by Arthur Chan.)
zic no longer overflows an int when processing input like `Zone
[4 lines not shown]
